CVE-2024-32870

published 2024-11-05

CVE-2024-32870: Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone…

Priority P1 79 medium 5.8 CVSS 3.1

AV N AC L PR N UI N S C C L I N A N

ITW EXPLOIT VulnCheck KEV

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
combodo	itop	< 2.7.11	2.7.11
combodo	itop	—	—
combodo	itop	—	—
combodo	itop	>= 3.0.0 < 3.0.5	3.0.5
combodo	itop	>= 3.1.0 < 3.1.2	3.1.2

Detection & IOCs extracted from sources · hover to see the quote

url /pages/exec.php?exec_module=itop-hub-connector&exec_page=launch.php&target=inform_after_setup↗

other html:"iTop login"↗

other body="iTop login"↗

• → HTTP GET request to the vulnerable endpoint returns a 200 response containing sensitive configuration keywords in the body, indicating successful information disclosure. ↗
• → Response body contains the strings 'database_settings', 'database_version', and 'instance_host' — all present simultaneously — confirming exploitation of the information disclosure vulnerability. ↗
• → No authentication is required; the endpoint is accessible to any unauthenticated user with network access to the iTop URI. ↗

• · The vulnerability is present in iTop versions prior to the patched releases; detection is only relevant against unpatched instances (before 2.7.11, 3.0.5, 3.1.2, and 3.2.0). ↗

CVSS provenance

nvd v3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

vulncheck 5.8 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200